How to disable weak SSL ciphers for SSL/TLS Service Profile within a Panorama Template

How to disable weak SSL ciphers for SSL/TLS Service Profile within a Panorama Template

12129
Created On 03/29/23 17:47 PM - Last Modified 03/31/23 18:34 PM


Objective


To disable weak SSL ciphers for SSL/TLS Service Profile within a specific Panorama Template

Environment


  • Panorama
  • PAN-OS 9.1 and above


Procedure


  1. Enter Panorama CLI.
  2. To view the list of ciphers, enter the command below and hit the TAB key.
# set template my-template config shared ssl-tls-service-profile test protocol-settings   ---(HIT TAB)
+ auth-algo-sha1         Allow authentication SHA1
+ auth-algo-sha256       Allow authentication SHA256
+ auth-algo-sha384       Allow authentication SHA384
+ enc-algo-3des          Allow algorithm 3DES
+ enc-algo-aes-128-cbc   Allow algorithm AES-128-CBC
+ enc-algo-aes-128-gcm   Allow algorithm AES-128-GCM
+ enc-algo-aes-256-cbc   Allow algorithm AES-256-CBC
+ enc-algo-aes-256-gcm   Allow algorithm AES-256-GCM
+ enc-algo-rc4           Allow algorithm RC4
+ keyxchg-algo-dhe       Allow algorithm DHE
+ keyxchg-algo-ecdhe     Allow algorithm ECDHE
+ keyxchg-algo-rsa       Allow algorithm RSA
+ max-version            max-version
+ min-version            min-version
  <Enter>                Finish input
  1. Find the weak cipher you wish to disable and select no with command below
# set template [Template name] config shared ssl-tls-service-profile [profile name] protocol-settings [cipher] no
*(Example disabling enc-algo-3des)
# set template my-template config shared ssl-tls-service-profile test protocol-settings enc-algo-3des no
  1. Commit to Panorama.


Additional Information


HOW TO DISABLE MEDIUM STRENGTH SSL CIPHERS FOR SSL/TLS SERVICE PROFILE FOR FIREWALL

Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000kHYwCAM&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Choose Language